Retirement Could Wait. Cybercriminals Couldn’t

TLDR

• John Watters, former president of Mandiant, came out of retirement after he saw what generative and agentic AI could do. He knew it would reshape cybersecurity.
• He founded a threat intelligence startup called iCounter that collects its own intelligence and uses digital twins to identify customer-specific risks in real time.
• The startup grew from nine employees to 83 this year, with five more coming on board soon. It plans to close its Series A round in December.

John Watters tried retirement. He even took up fly fishing. There was just one problem.

“I wasn’t very good at it,” he recalled.

After a career spent tracking cybercriminals and building companies to help businesses defend themselves, the former president and chief operating officer of Mandiant – acquired by Google for $5.4 billion in 2022 – was due for some rest and relaxation. So he joined a few boards, worked with investment firms and tried to enjoy life outside the cybersecurity trenches.

Then generative and agentic AI happened.

“I was like, wow, this is reshaping the entire industry,” he told The AI Innovator. Watters realized that the speed, scale and intelligence of these AI tools meant cybersecurity has to move at the same speed.

“There’s been such a mammoth time compression, and this was the challenge that I wanted to rise to by coming out of the ashes of retirement,” Watters said. “You cannot deal with it using a traditional approach to intelligence security. It doesn’t work.”

Today, he is the founder and CEO of iCounter, a Dallas-based threat intelligence startup spun out of cybersecurity company Apollo Information Systems to reinvent how companies defend themselves against attacks that increasingly move at machine speed. In July 2025, the startup publicly emerged from stealth with $30 million in Series A financing, led by SYN Ventures.

To be sure, the startup is entering a crowded cybersecurity market, where established companies and well-funded newcomers are racing to apply AI to threat detection and response.

But Watters argues that iCounter’s advantage lies in collecting its own intelligence instead of relying on third-party reports. This speeds up the process of warning customers about incoming threats. Also, by matching incoming threat intelligence against digital twins of customers and their suppliers, it aims to identify specific risks in real time and initiate defensive actions.

Further, iCounter is targeting a specific market: suppliers, contractors and technology providers that do business with corporate clients. These third-party vendors often provide attackers with an easier way inside.

90+ days of inaction

The traditional cybersecurity model was straightforward: Gather intelligence about cyber threats, analyze it and deliver the findings to companies so their security teams could respond. That worked when attacks moved slowly enough for people to investigate them.

But AI is changing the equation.

Attackers can now automate reconnaissance, identify promising targets and generate customized attack methods with far less human effort. Meanwhile, defenders are still sorting through alerts, comparing intelligence reports, investigating vulnerabilities and deciding what to do next.

Watters said the traditional process of turning a threat signal into a defensive action took an average of more than 90 days in 2025.

Even if that estimate varies across organizations, the underlying problem is clear: Cybersecurity that waits until threat signals are handed off from team to team is too slow against an automated attacker.

While companies are adding AI to existing security tools, it is making each step faster without fundamentally changing the process, Watters contends. He said his approach is to combine intelligence gathering, risk assessment and defensive action into a single system.

And at the center of that system is a digital twin.

A digital twin for every potential victim

Digital twins are usually associated with factories, aircraft engines or industrial equipment. They are virtual representations of physical systems, used to simulate performance or predict problems.

Watters is applying the concept to cybersecurity.

Instead of modeling a machine, iCounter builds a digital picture of a company’s technology environment: its internet domains, software, network connections, exposed systems and other identifiable digital assets.

Consider a hacker selling stolen administrator credentials on a criminal marketplace.

A conventional threat intelligence service might report that the credentials are available. Security analysts would then have to determine which company they belong to, whether they are still valid and what systems they might expose.

Watters wants to make those connections automatically.

Its software compares incoming threat intelligence with digital twins of companies and their suppliers. When it finds a credible match, it can trigger a response, such as notifying the affected company and initiating a password reset.

“The risk determination at the speed of machine speed is really what matters,” Watters said.

Asked whether building these digital twins requires companies to hand over their proprietary information, Watters said iCounter taps external information and uses reconnaissance techniques to flesh out the picture.

He acknowledged that the resulting models are incomplete, and they won’t always identify all the risks. But “an 80-percenter is good enough,” he said.

The supplier is the new front door

Why start with supply chains?

Because even a company with sophisticated cybersecurity defenses may have thousands of suppliers whose security practices it cannot continuously monitor.

Those suppliers might store sensitive customer information, maintain privileged access to corporate systems or provide software essential to daily operations.

An attacker doesn’t necessarily need to break through the defenses of a major corporation. Compromising a smaller vendor with trusted access may be enough.

History offers plenty of examples.

Watters pointed to the 2017 NotPetya malware attack that spread through compromised Ukrainian accounting software, disrupting businesses around the world. The 2020 SolarWinds attack exploited a trusted software update mechanism to reach numerous organizations.

Both demonstrated how a single compromised supplier could become an entry point into many customers.

AI threatens to make that strategy easier to execute.

An attacker can use automated tools to map a company’s suppliers, identify exposed systems and search criminal marketplaces for stolen credentials.

The result is a potentially enormous attack surface that corporate security teams struggle to monitor.

Watters said companies may have good intelligence about threats to their own networks but little ability to continuously detect active attacks against thousands of suppliers.

That’s the gap iCounter is targeting. “We are focused on the biggest pain point, the supply chain, which now makes up half of the breaches,” he said.

Rather than periodically checking whether vendors follow security policies, the company monitors for evidence of active threats and tries to get those threats neutralized before attackers can exploit them.

70 minutes to stop an attack

In one pilot with a major telecommunications company, Watters said iCounter identified a leaked administrator credential belonging to a supplier that had network access to the telecom company’s systems.

The service notified the supplier by email and requested an immediate password reset.

According to Watters, the supplier confirmed the action, and the entire process – from threat signal to defensive response – took 70 minutes.

It wasn’t a fully autonomous intervention. A human at the supplier still had to act. But Watters sees it as evidence that the time from detecting a threat and responding to it can be greatly shortened.

The company operates the system as a managed service. Customers can review a dashboard showing which suppliers have active risks, which incidents have been resolved and which still require attention.

They can also configure when they want to receive alerts. If a supplier fails to respond to a serious threat, iCounter can escalate the warning to the customer.

That matters because simply sending more alerts would reproduce one of cybersecurity’s oldest problems: overwhelming defenders with information.

Cyber warfare economics have flipped

Watters sees an even bigger transformation underway. AI isn’t merely accelerating attacks. It is changing how much work a small team can accomplish.

In the past, he said, a human intelligence collector might manage 30 to 50 online personas used to monitor criminal communities.

With AI assistance, that number can rise to 300 to 500, according to Watters.

The economics of software development have changed just as dramatically.

“Every great idea I had came with a two-year timeline and a $10 million budget,” he said. “Great ideas I have today come with a two-day timeline and a one-person budget.”

iCounter is growing quickly, at least by the company’s account.

Watters said its workforce had expanded from nine employees at the beginning of 2026 to 83 by late October with five more coming on board in a few weeks. He also expects to close a Series A funding round in December.

Retirement can wait.